Understand PSD2, SCA, and 3DS

If your Advanced Billing account processes card payments in the European Economic Area, PSD2 compliance affects your checkout flow, your supported gateways, and how failed renewals are handled. Understand which gateways support 3D Secure and what your integration needs to stay compliant.

PSD2 is the European regime. If you process recurring card payments in India, the equivalent requirements come from the Reserve Bank of India rather than PSD2 — see Understand RBI Rules for Recurring Card Payments and e-mandates.

What is PSD2 and SCA?

PSD2 is a European Economic Area (EEA) regulation that requires Strong Customer Authentication (SCA) as a means to increase security and authorization rates while decreasing online payment fraud. Only transactions where both the issuing and acquiring banks are in the EEA are affected by PSD2, so this only affects you if your acquiring bank is in the EEA.

SCA must be collected prior to processing a payment by authenticating two of three possible identification traits: something the customer owns, knows, or is.

3D Secure (3DS) has become the most common, globally accepted security protocol that collects and confirms SCA. 3DS was initiated and created by Visa and Mastercard and may be familiar to some merchants through these card networks' brand names such as Visa Secure and Mastercard Identity Check. PSD2 turns 3DS into a requirement instead of a nice-to-have.

A PSD2 transaction follows this general flow:

• When a customer initiates an online transaction, the issuing bank may flag transactions that require SCA based on a number of criteria.
• Your payment gateway receives this request and initiates 3DS in order to authenticate the customer.
• Advanced Billing receives that request and shows the 3D Secure challenge to your customer.
• Once SCA is confirmed, it is sent back to the issuing bank to successfully process the transaction.

Which gateway integrations are enabled with 3D Secure and stored credentials?

• Stripe
• Braintree
• CyberSource
• Windcave (formerly Payment Express)
• Adyen
• BlueSnap

What do you need to do to comply with PSD2?

General guidelines are listed below. See Test and Implement 3D Secure for gateway-specific information.

Reach out to your gateway about 3D Secure

If you meet the requirements for PSD2, the first step is to reach out to your gateway to enable 3D Secure on your account. When SCA is required, your gateway receives the request and serves 3D Secure challenges that Advanced Billing automatically includes in your checkout experiences; see below for more detail on this.

Enable gateway 3D Secure access in Advanced Billing

After you've enabled 3D Secure with your gateway, you may also need to make gateway-specific updates in your Advanced Billing account to authorize Advanced Billing to communicate with your gateway's 3D Secure service. In some cases a separate 3D Secure service is used, so you need to add additional API credentials to give Advanced Billing access to receive and serve these 3D Secure challenges to your customers. Visit your gateway settings page in Advanced Billing to verify that you have included all required credentials to enable 3D Secure.

Update your card collection pages

If you are using Advanced Billing's hosted pages for payments, such as the Public Signup Page, Self-Service Page, and public invoice URLs, no further action is required on your end. These pages have all been updated to handle any SCA requests by default.

Any custom integrations that create Subscriptions, transactions, or credit card payment profiles via API need to be reviewed to ensure they are prepared for 3D Secure.

• Additional work may be required if you have implemented Maxio.js (formerly Chargify.js) and your gateway uses our post-authentication strategy, which is currently only Stripe and Braintree.
  • For sites using Stripe or Braintree, customers must be manually redirected to an action_link that Advanced Billing returns when a transaction fails due to requiring SCA.
  • For all other gateways, the customer is automatically provided a pop-up to authenticate with 3DS when their token is generated with Maxio.js. However, these gateways need a field added to the Maxio.js form.
  • See Test and Implement 3D Secure for more details.
• Chargify Direct: This is an old integration method which is deprecated and does not support 3D Secure. If you are using Chargify Direct, we encourage you to move to our newer Maxio.js, which allows you to take advantage of all of our recently released features and removes PCI compliance burden from your company. For more information on how to switch from Chargify Direct to Maxio.js, see Understand Maxio.js.

Update your dunning emails

There are two cases in which transactions are created without your customer being present: subscription renewal transactions, and transactions created when you create a new Subscription inside the Advanced Billing UI manually. These transactions are generally exempt from SCA, though the issuing bank may still request it in rare cases. Advanced Billing's dunning system helps save these transactions from failure by automatically sending emails to communicate the reason the transaction failed to your customer, along with a prompt to visit Advanced Billing's Self-Service Page to either authorize the transaction with 3D Secure or enter a new credit card.

What else is Advanced Billing doing to ensure that your transactions process successfully amidst PSD2?

Advanced Billing has put in a lot of work to ensure that your transactions are exempted from SCA wherever possible, and to ensure that when SCA is required your gateway's 3D Secure service passes seamlessly through Advanced Billing's checkout experiences to achieve the highest possible success rates for your customers. Below is a list of various workflows that have been modified to account for SCA requests.

Renewal transactions

Stored Credentials: Renewal transactions are exempted from SCA because no customer is present to authenticate the transaction. To receive this exemption, the transaction must be marked as a "Merchant Initiated Transaction" and must include a prior transaction ID to prove that a prior relationship exists with this customer. In many cases the gateway has automated this process and Advanced Billing simply includes a recurring flag when it submits these transactions to the gateway. However, some gateways do not support stored credentials, and in those cases Advanced Billing submits these transactions as MITs and includes prior transactions to ensure that these transactions remain exempt from SCA.

3D Secure: While renewal transactions should always be exempt from SCA, the issuing bank can choose to ignore this exemption and request SCA whenever they wish. Advanced Billing includes measures to ensure that when SCA is required on renewal transactions, your customers are able to authorize the transaction at their convenience. If a renewal transaction is not successful because SCA is required, the Subscription moves to past due status and dunning kicks off.

Update dunning emails for failures due to SCA

When a renewal transaction requires SCA, the transaction fails with a reason code related to SCA being required. The Subscription moves to a past due status and dunning emails are sent to the customer letting them know why the transaction failed and encouraging them to visit Advanced Billing's Self-Service Page to authorize the transaction. We recommend updating your dunning emails to tailor these emails for your customers.

Self-Service Pages

Advanced Billing's Self-Service Pages detect if a renewal transaction is awaiting SCA and include a link to the 3D Secure page to allow the customer to authenticate the transaction rather than enter new credit card information.

When new credit cards are collected using Advanced Billing Self-Service Pages (SSPs), Advanced Billing runs authorizations on the card with 3D Secure that are used as initial transactions to ensure that your later renewal transactions process successfully.

If a prior transaction on the Subscription is awaiting SCA, a link is shown on the SSP so that your customer can authenticate via 3D Secure directly from the Self-Service Page.

Invoices

If SCA is required when your customer attempts to pay an Advanced Billing invoice, your gateway's 3D Secure challenge page is presented to your customer in a modal, or pop-up, on the page.

Public Signup Pages

When SCA is required while creating Subscriptions using Advanced Billing's Public Signup Pages, 3D Secure challenges are presented to your customer directly in the PSP, and the Subscription is not created unless 3D Secure passes successfully.

Creating subscriptions in the Advanced Billing user interface

When you create Subscriptions in the Advanced Billing UI, these transactions are classified as Mail Order and Telephone Orders (MOTO) whenever possible, since the credit card information is usually collected via telephone, mail, or another similar method. For the most part, SCA should not be required, but the customer's bank may request verification at any time.

If an initial transaction occurs and fails due to SCA, the Subscription is not created. If SCA is required and you prefer to have the customer authorize the transaction via your dunning flow, you can push out the Subscription start date. This approach skips any trial or setup fees on the Subscription's product.

Creating credit card transactions or authorizations via API and Maxio.js

When SCA is required on transactions created via Advanced Billing's API, Advanced Billing returns a response with a redirect link parameter called action_link. Make sure your pages are updated to handle these action_link redirects. Advanced Billing has integrated with the 3D Secure systems of all 3D Secure supported gateways to ensure that these 3DS URLs and tokens are passed seamlessly between Advanced Billing, your gateway, your gateway's 3D Secure service, Visa/Mastercard, and the issuing bank.

Pre-authentication gateways

Pre-authentication payment gateways such as CyberSource, Windcave (formerly Payment Express), or Adyen require the end-customer to be actively in the session to validate SCA through 3D Secure. Because of this requirement, certain workflows aren't supported because they do not involve the end-customer being in the session.

• If the card collection, passing the full credit card details, is happening through the API (including new signups and card updates), the end-customer is not actively in the session, so this method for card collection is not supported.
• If the card collection is happening through the Advanced Billing admin user interface, the end-customer is not actively in the session, so this method for card collection is not supported.

It is recommended to make use of the Understand Public Pages for new signups, and Understand Self-Service Pages or Understand the Billing Portal for card updates. If you wish to continue using the API or user interface for signups, adjust your flow to sign the end-customer up to a no-cost/free product that doesn't require card collection, collect their card through a Self-Service Page or Billing Portal, and then follow the Change a Subscription's Plan process to charge them for the product.